There was problem with the order of operations - changeset
application modifies the changeset, so it must be done after
the changeset is saved to disk.

Also simplified the operation a lot. First the newly loaded zone
is signed and then the diff is generated (signed zone vs old zone
in memory). Thus we do not need to do changeset merging and other
such magic. The old code was wrong, as it may have lead to a
situation when user makes some changes to DNSSEC records, those are
overwritten by signing the zone, but the changeset contains both
changes resulting in non-consistent zone.

Utils Edns

fixes #211

Conflicts:
	src/knot/server/zones.c

Zonefile loading fixes

Most is said in the commit.
I would have refactored zone-load more (especially the custom rrset lists could be standard ptrnode_t list from list.h) and a few other things,
also it should be named something like `zonefile.h` as we already have a `zone-load.h` file which is for zone loading in general and makes it confusing.
But I didnt, as @jkadlec made a lot of changes in the rrset->rrsigs and I suspect this would result in nasty collisions (like the rrset lists code).
So... this should be done after his branch is merge-able.

NSEC/NSEC3: Fixed wildcard expansion proofs and previous node lookup + tests

Most of it is written in the commit comments, it's still not pretty but at least it works for now.

- refactored the zone-loader a bit, as reading from zone file
  creates only contents and the zone is created separately
- refactored zone contents creating function, as it is always used in a
  way where an apex node is created and inserted into contents
- crash occured because created zone bound configuration and if parsing
  failed, the configuration was freed with the zone and also with the
  caller

cov#1165386

cov#1165387

cov#1168292

cov#1169882

cov#1165390

- new test for wildcard expansion leading to NXDOMAIN
- new test for wildcard expansion leading to NODATA

authoritative

- this is temporary, as looking up closest encloser and previous
  is not required (or doesn't make sense) in all situations
- zone search should always return lexicographically previous node
  and the proof code should look up the encloser or previous node
  should it be needed

- every RFC5155 state may have visited a wildcard in processing,
  therefore they need to be proven
- fixed duplicate NSEC wildcard proof in no data case

- previously parent was added for MISS state, not the wildcard child
- removed deprecated MISS masking after following CNAME chain, as
  names leading out of zone are handled correctly